A critical path traversal vulnerability in Tautulli allows unauthenticated attackers to exfiltrate sensitive configuration files and databases, potentially leading to full administrative compromise.

This is a relative path traversal vulnerability (CWE-23) located in the /image API endpoint. An unauthenticated attacker can manipulate requests to access sensitive files on the host system, including the tautulli.db database and config.ini file.

The ability to read arbitrary files poses a severe risk to organizational security. By extracting the config.ini and database files, an attacker can obtain hashed administrative passwords, valid JWT tokens, and sensitive Plex Media Server credentials. Given the CVSS score of 8.6, this vulnerability constitutes a high-severity risk that could lead to full unauthorized access to the monitoring infrastructure and potential lateral movement into the connected Plex environment.

Immediate Action: Update Tautulli to version 2.16.0 or later immediately to apply the vendor-provided patch.

Proactive Monitoring: Review web server access logs for anomalous requests to the /image endpoint, specifically looking for directory traversal sequences like dot-dot-slash (../) patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests containing path traversal sequences directed at the /image API endpoint.

Public Exploit Available: Unknown (No weaponized exploit or public proof-of-concept repository identified in enrichment data).

Due to the sensitive nature of the information exposed by this path traversal flaw, administrators should prioritize this update immediately. Failure to patch allows unauthenticated actors to gain deep visibility into server configurations and potentially escalate to administrative control. Organizations must treat this as a high-priority remediation task to prevent credential theft and unauthorized application access.